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Claims 

1. A method for assigning packets belonging to traffic of a network to different 
quality of service (QoS) treatments, comprising the steps of 

receiving a packet, and 

assigning the packet to one of a preselected of QoS treatments, based to an attribute 
the packet, in accordance with a set of rules that was created pursuant to a statistical 
analysis of traffic in the network. 

2. The method of claim 1 where the network is an enterprise network that is part of 
a larger network. 

3. The method of claim 2 where the larger network is the Internet. 

4. The method of claim 1 where the attribute is a field in a header of said packet, 
and said assigning is based on value of said field. 

5. The method of claim 4 where the field is a connection port number. 

6. The method of claim 4 where the field is a source IP number. 

7. The method of claim 4 where the field is a destination IP number. 

8. The method of claim 1 where said step of assigning is based combination more 
than one attribute. 

9. The method of claim 8 where said step of assigning is based values of said more 
than one attribute. 

10. The method of claim 1 further comprising an analysis process for creating said 
set of rules, said analysis process comprising the steps of: 
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obtaining statistical data regarding connections in said network, segregated by 
different values of said attribute, which statistical data pertains to preselected connection 
features, and 

associating each of said values of said attribute with a class, pursuant to a 
classification that maps said statistical data to classes, based on previously conducted 
training session that extracts characteristics of said preselected features for each of said 
classes. 

11. The method of claim 10 further comprising a training process for executing 
said training session, said training process comprising the steps of: 

selecting applications that are representative of different ones of said classes; and 
analyzing traffic in a training network that belongs to said applications, to develop 
statistics for said preselected features. 

12. The method of claim 11 where said training network encompasses more than 
said network where packets are assigned. 

13. A method executed in a network for assigning packet traffic to classes of 
service comprising the steps of 

receiving a packet; and 

assigning the packet to said one of said classes based on one or more attributes of 
the packet, pursuant to a mapping derived from analysis of past traffic on said network, 
which analysis correlates said one or more attributes associated with packets of different 
connections with connection features. 

14. A method for developing a corpus of data for creating set of rules for assigning 
packets for different QoS treatments, comprising the steps of: 

selecting a set of classes; 

selecting a set of applications, where each of said applications unambiguously 
belongs to only one of said classes, and where said set is such that every one of said classes 
is covered by at least one of the application in the set; 
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selecting a set of features; 

capturing traffic in a training network, which traffic belongs to applications that are 
included in said set; and 

developing statistics for said set of features for each of said classes from said traffic 
in said training network. 

15. A method for developing a set of rules for assigning packets in a target 
network to different classes, comprising the steps of: 
selecting one or more packet attributes; 

analyzing traffic in said target network to create statistical information for each 
value of said one or more packet attributes, which statistical information pertains to the 
selected set of features of claim 14; and 

classifying each of said values of said one or more packet attributes into one of the 
classes of claim 14 based on a selected algorithms that investigates said statistical 
information for each of said values of said one or more packet attributes and the statistics 
developed in the method of claim 14. 

.16. The method of claim 15 further comprising a step of mapping said classes to 
QoS treatments. 

17. The method of claim 15 where said step of analyzing to create statistical 
information creates said statistical information recursively. 

18. The method of claim 15 where said step of analyzing analyzes traffic of a 
predetermined time interval of data. 
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